PT-2026-106360

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA affected versions not specified Description Improper authentication in the OAuth token endpoint allows a remote, authenticated attacker with a valid user access token to obtain a fully-privileged client credentials token for...

CVE-2026-106488: Improper Authentication

Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverifi...

CVE-2026-106460: Improper Authentication

Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email...

CVE-2021-26088

PoC per CVE-2021-26088 scritto in PowerShell Descrizione Una vulnerabilità di autenticazione impropria in FSSO Collector potrebbe consentire a un utente non autenticato di bypassare qualsiasi regola di autenticazione del firewall e accedere alla rete protetta inviando pacchetti di notifica di log...

CVE-2025-22968

CVE-2025-22968 D-Link DWR-M972V Software Version 1.05SSG Vulnerabilità di accesso non autenticato Descrizione L'accesso non autenticato nella configurazione predefinita del D-Link DWR-M972V versione software 1.05SSG consente a un attaccante anonimo di accedere al router e caricare script backdoor...

CVE-2026-105640: Improper Authentication

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set ...

CVE-2026-59358 - UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type. | Cloud Foundry

Severity High CVSS score: 7.6 High CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Vendor Cloud Foundry Foundation Versions Affected Severity is High unless otherwise noted. UAA – All versions from UAA v3.7.0 to v79.6.0 inclusive; CF Deployment – All versions to v60.4.0 inclusive...

CVE-2017-7921-EXP

CVE-2017-7921 Exploit Um problema de autenticação imprópria foi descoberto em dispositivos Hikvision. ​ A vulnerabilidade de autenticação imprópria ocorre quando um aplicativo não autentica os usuários de forma adequada ou correta. ​ Isso pode permitir que um usuário mal-intencionado eleve seus...

CVE-2017-7921-EXP

Exploit CVE-2017-7921 Un problema di autenticazione impropria è stato scoperto nei dispositivi Hikvision. ​ La vulnerabilità di autenticazione impropria si verifica quando un'applicazione non autentica gli utenti in modo adeguato o corretto. ​ Ciò può permettere a un utente malintenzionato di...

CVE-2017-7921

CVE-2017-7921 CVE-2017-7921 è una vulnerabilità critica punteggio CVSS: 9.8 che colpisce diversi modelli di telecamere IP e DVR Hikvision, resa nota per la prima volta nel 2017. Deriva da un difetto di autenticazione impropria che consente a utenti remoti non autenticati di aggirare i meccanismi ...

CVE-2026-105133

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack...

CVE-2026-105133 Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack...

CVE-2026-105133

A vulnerability exists in Ahsay AhsayCBS versions up to 10.3.2 within the API component. The flaw is located in the checkSysPwd function of the file com/ahsay/obs/api/ApiStructsAction.java, where manipulating the random argument leads to improper authentication . This issue can be exploited remot...

CVE-2026-105133 Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack...

EUVD-2026-92079

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack...

CVE-2026-105213: Improper Authentication

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and...

CVE-2026-105133: Improper Authentication

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack...

PT-2026-104607

Name of the Vulnerable Software and Affected Versions Ahsay AhsayCBS versions prior to 10.3.4 Description An issue in the API component allows remote attackers to achieve improper authentication. This occurs through the manipulation of the random argument within the checkSysPwd function located i...

CVE-2026-105210: Improper Authentication

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-97343

The Burst Statistics – Simple WordPress Analytics Google Analytics Alternative plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions up to, and including, 3.7.1. This is due to the maybeloadshareddashboard handler issuing a genuine WordPress...